fixes #157 - User permissions