sails-permissions: Permissions ignored in custom User.find

If I put the following in my own UserController permissions seem to be ignored and a user making a request to /user can see all users

module.exports = {
  find: function(req, res) {
    User.find().then(function (users) {
      res.ok(users);
    });
  }
}

If I remove this they only can view their own.