Added permission check to @put endpoint