fixed security hole in profile edit