User request.user.has_perm instead of permission_required decorator.

Signed-off-by: cyberzhg <cyberzhg@gmail.com>