moved reading permissions config to servlet init