Added verification of permissions to API show action