Restrict access to edit/update actions.

Add a policy to only allow users to edit their own profile data.