fixed permission for user edit