finish off basic permission system