minor bug fixes with routing and permissions