added user permissions checks