bug in user permissions