added quick fix for not allowing edit or delete buttons for modifying users.
@TODO prevent API hack of actions via controller with CANCAN or devise