export function removePermission(req, res, next) {
  const rbac = req.server.rbac;
  const user = req.user;
  if (!user) {
    return next(new WebError(401));