Fix user permission checks