check permissions before modifying permissions
add some checks, clean up