make permissions check use request.user.email instead of .username