added permissions checking and requests for user_groups