added additional permission checks and "restart" permission (#260)