Modified toJSON and toForm methods to check permissions correctly