added permission check for membership applications