Added permission checking to show routes