Put purchase actions behind perform_purchase permission