moved roles perm check above entity perm check