auth user before edit or delete