locked down most PUT methods via permissions, admin only
started individual player#show pages