check permissions here for who can update the story