the current user can only view their own reservations and profile. Also, added a custom route.