check for permissions on actions based on settings (closing #251)