authenticate user && check_user before edit/destroy