make sure we check permissions for all controllers