Fixed controller permissions for many to many relations