Restrict destroy to users with permission