Fix finding users
Add explicit permissions checking