Fix several bugs in permission checks in frontend