user/profile, no privilege redirect fixed