added model-stored permissions thing. needs tests