users can only update their own reading list