moved the permission check before searching children.

this changes permission requirements: to be able to access a child command, permissions to the parent command must be set as well.