moved permission check to AbstractUserService and adapted tests