add protect for edit user and destroy