add authorization for user edit/update

page 390