prevent settings edits with different user id's in the url