moved permits controller to trade namespace, as this information should not be exposed via API