Change permission checking in User and Group controllers