Added Express permissions middleware