dont output empty box <div> see #9
reworked permission checking