fix bug with user permissions