All service calls should get intercepted, and the logged user should have permission on the service's level.
