controllers: check user permissions for action controller