make permissions.js check for the right permissions
slightly refactor permissions.js
only add the iframe in certain cases
tweak the styling of the permission iframe