add a new api function to get current user's profile
restirct access