flesh out permissions
permission checking belongs in model not controller