I'm not sure I quite understand in what context a permission gets updated and why there is the need to cross check emails before setting a null user id to the current logged in user. Could you provide some descriptive comments?