permission check for socket.io calls