user should now be editable; user can't edit their password though