check user permissions