Missing permission checks in backend

[cesar-circle]

Permission checks are implemented in the frontend, those should be also implemented in the backend to prevent somebody to go directly agains the backend