Added the permissions check to leads (see #8)