fix authorizations for edit/update_plan, profile
adding link to user subscription