The logic here is a little subtle so I want to call it out.  When you are creating a new post, there is not postModel defined because there isn't an id yet.  In that case we just fall through to the original permission checks value in `hasUserPermission`.