restrict access to users#show, only that user can view
Can't pass User validations with User.create!(username:'u', password:'p', email:'e')