user must be current user to see user show page

Added "show" under authorization in users controller