restrict delete/edit access to requestor