Add permission checking to /back