made list controller sensitive to permissions and user_id