working with permission in rest verbs