fixed the mismatches in id form keys, added permission checking for create, update and delete methods