test: user cannot edit others' bills