remove duplicate permission checks from all controllers