are there lots of other places you are doing permission checks? I just think this could be extracted since it is used in two places in this controller and is a lot of `||`'s