fixed permissions for user access