prefer variable USER
improve BaseHandler.make_permission