Provider REST API permissions checking improved to use common method