removed automatic refreshPermissions, and added a proxy method to do this