restrict edits to logged in users