Moved permission checks to the controller and added the context to them.