[UPDATE] moved user rights checks