permissions improvements and a cpl bugfixes