isolating posts controller permission logic