updated permission handling
updated destroy route
destroying record only with management privs