added access check for update and delete