only admins can update and destroy metadata