cleaned up has_permissions()

now checks cwd, bwd, awd in order to determine real owner.