'remove', 'read' methods missing authz logic