move helper methods to helper file
add read_access? and update_access? helper methods
also require read access for everyrequest, except for root_path