don't use roles and permissions for the same route