add tests for second users and fix discovered bug where users could update others' posts