added isPermitted method to controller that must return true for the action to be invoked