- Added permission check for UpdateStudent owner