users can now only edit their own profile