On receiving a new story, check the user has the appropriate permission