fixed broken permission handling in controller
implementing batch deletion of users