bugfix in permission controller