Added restriction that a User can only get Student by id if that student is tied to the User in StudentResource.