fixed user permissions