migrated more permission-related stuff over