Add access control for relation updates and deletes

Previously was not testing permissions on the `../links/..` update methods. 
We can. Can you elaborate why?