added more authentication checking and restrictions to all views for creating, editing or deleting objects that should only be done by staff