[#1695] add access control to update/deleting challenges