Add access control for relation updates and deletes

Previously was not testing permissions on the `../links/..` update methods. 
don't think you need the format: :json option here