added lib/permissions.js