added hasPermission to authenticator