restrict destroyaction to only people with permission