tightening the permissions a bit again