protecting edit and update with a before filter