created a user profile page but a user can access and user profile