fix authorization checks for /api/users/profile/me route