use permitted_to? to hide management links based on current_user authorization