fix bug in adding/removing researchers, check for permission before granting credentials