refactored loadUser in permissions