added permission checks to creating/editing a tour