modify permission middleware to handle single level root resources