Fix up permission checks in json responses