[webui][api] brought permission check to controller and also using has_local_permission? now