add access checking to remaining crud functions