Added permission checks for <CardType> into CardTypeController and into main view plxmain.ejs