fix devise
add check user profile permision