allow logged-in user to only update their own profile