respect can_create/can_delete permission + unit test