added some permissions checks on the backend