edit: users can update, redirect to show w/ flash