put default permission check in else clause

otherwise it always overwrites the super-admin check