added support for user aliasUrls in permissions