permissions method users parses strings instead of arrays