modified users controller to only allow editing of currently authenticated user