Fixed: main menu should reflect actual user permissions