fixed authorization so users see only their profile page