Oops.

Also, will finish moving other permission checks to server side later.