raise PermissionDenied if someone tries to save an object without can_update rights