fix profile vuln

fix vulnerability where any userprofile could be deleted by any
registered user