Prevent other than the user itself to edit avatar or password