hide buttons to match permissions