slap user if they don't have enough permissions