Correct $this to actual variables
Add delete_programmes permission
Users who can't delete programmes don't see this option
Protect all other routes in the revisionable controller