simplify refs. user permission juggling