permission check for postdelete