Updated middleware for permissions