Only allow the same-session user to edit without an identity token