add validation - you have to be the correct user to see user profile