Pass req to putPage, which is now in charge of permissions checking