simplify permissions logic, co-owner => admin, make permissions tests pass