permission cleanups