Add a permission check inside of Spell.cast