Refactored permissions to deal with multiple roles