fixed a couple of bugs in ac permissions logic