Check permissions for actions on urls