moved request permission behind login