testing that edit and update actions are protected