only allow updating time if logged in as staff