updated permissions on user profile page