permission check for users list and destroy