fix "user/edit", fix permission