custom accessrules for profile: user can only view and update own profile