middleware disabled in favour of default permissions class