add permission check for backend controllers