authorization check for user edit buttons

fixes #433