protect accsess to user profile