add user authentication for edit, update, destroy