fixed bug users can delete or edit without signed in