add permission check to /:name/:tag