Added needed permissions dependent on whether current user is admin and/or == model.user