set the check permission flag for a route