Changed: the /doctypes route doesn't require permission anymore