Implemented permissions checks server-side