check permission on submit controller