Per-controller/per-action permissions checking instead of per-resource.