fix a controller method permission bug