edit and update only for the right user