add permission check to toggle command