Better way to check user permission