change #permitted_by default action to #show