fixes #3: add permitted_to matcher