removed unnecessary permission check and add return after redirect

The initial permission check is no longer needed becauses it has
been moved into the app_controller already.