fixed user authorization when showing user profile