Permission check (session.props) in the RESTful api.