update access control check for can_change and can_view