fix permissions on profile page