Move checking permissions to base controller