some more permission-check improvements