Security fix: Access control for user profile actions.