limit access to 'edit' page to creator