added facility code check as part of permissions check