Table sorting button - deny user select

- fixed
Backend permissions resolution.

Resolved permissions stored in req.