added role/permission checks for controls on the views, controllers haven't been checked for permission compliance