only allowed to edit and destroy self user

as title