incorrect checking of user premissions ?