Add permission check in content and location rest controllers