def _update_result(self, user, result):
    """Allow project owner or admin to update results."""
    if user.is_anonymous():
        return False
    project = self._get_project(result, result.project_id)
    return (project.owner_id == user.id or user.admin)