fix issue where user could change records other than his own