edit user: add permision, fix redirect