permission added to quiz route