Some refactoring in auth: check permissions