Bug when checking multiple permissions

the has function checked only the first permission.