clarify need for () with the permission_required decorator