Usermanagement - Permission checks in Controller