remove @permission_required decorator