make profiles visible only to signed-in users; add cancel buttons