check user permission on post to backend