#75 Implement most of user permission checking