Added permissions requirements to all CRUD routes