Corrected User authorization; user can only see its own show page, admin can see all