add controller check for only owner can do edit on their profile