Support for more flexible role-based permissions

added another condition to the built-in Controller permission method