users can only edit their own memberships