remove useless permission check for /back