resource notes now checks for 'view' permission