users can update their info and only their info