bug fix user form and add permission validation