update /getpos to check vanish permission