Added Permission validation on the controller too