category edit/del auth