further cleanups
coverage of more permissions in controllers