fixes some permission logic and a unit test