refs #4126 make sure a user cannot read/change settings of another user