user controller: bugfix: edit the correct user

`User#edit` did not set the `@user` variable at all, and this resulted
in re-using the old `@user` variable (which was probably last set upon
logging in). For an admin, this meant that clicking on "Edit" always
edited his own information.