update permission interceptor

next step is to write the http crwaler

Signed-off-by: Winguse <github@winguse.com>