What about adding permission check for the PUT method?