permissions and urldecode