More refactoring of rights checks (#61)