assert that users can't update each others' categories