fixed permission checking