removed unneeded list controller
added permissions checking