[fix] permissions not checked to change state of a redirect