Add access control for relation updates and deletes

Previously was not testing permissions on the `../links/..` update methods.