LPS-43419 AlloyController - properly handle permissions checks