fix permission check

fixes #584, additionally fixes checks on url maps