Fixed controller and permissions so Athletes are pulled but only shown when ability allows