permission.remove(ok(next, (isDeleted) => {
      if (!isDeleted) {
        return next(new WebError(400));
      }