'persisten' url vars: initialize early
permissions again