fix create permission check