permission system for urihandlers