Fixes #483

And adds permissions checking to the list_files action.