restrict destroy to only people with permission