make checkUserPermission private