moved permissions checking into the controllers
Added a view for users to edit a given user