test that the edit and update actions require the right user