Modified controller for assigning permissions

Changed the controller to make sure that the person using the controller
is a head admin and that they were logged in. This prevents a pretty
major exploit, I hope.