js user permissions