Moving null user check to permissionsModel