only allow creator to view edit form