Make permission check optional for /scans* apis.

Once scans are created, we don't need to check permission anymore.