Only show edit button if admin, more robust ACL later