finished authorizations, users can only update their own information