protect create, update, and destroy in ProfilesController with Toke