Using permission_required now and refactoring