Adding more granular permissions and setting view variables on every response