bugfix module permissions, close #436