moved membership delete/update validation from contoller method to model