user must be current user to see user show page