update Users controller to deny access to other users' profiles