pass in object to verify:permission middleware