Maybe these views should do the permission checking themselves