fixed error where other user could update another's profile'