Put this in a permission and make the method act on `POST` not `GET` (since it modifies state).