some refactoring in permission checks, added tests