Add permission check to POST /scans.