Permission check on user object rather than username - fixes #1178