Forgot permission check for /user/