fixes #5 by filtering API text based on permission