check for view permission instead of isMember() + cs