adds authorization protection for Users#edit/update