server side permission checks