add controller method and spec for updating users' profiles