permission and login check