add permission checks

remove closing php tag
page is messy but it works for now