edit user path requires signed-in user