SECURITY FIX: Do not allow users to wildly delete users just because they are able to submit a form, for example because they have access to their own profile. Checking user edit access only on page access was a REALLY BAD IDEA.