validate correct user or admin to view users#show