Fixed user rights for products controller