using user-group for permissions now

getting user group for permission + some minor fixes to user_model