removed id from user route TODO: error msg for profile editing