Updated to use real permission for checking authenticated user.