edit.php: add capability check