abstract away permission checking on UserController to prep for dynamic refactor