api_views.py:
- update views that POST/PATCH to check for permissions