user edit functional but not yet secure
secure update and edit actions in users controller