Update controller/auth.php to allow admin edit

Line 516 had a validation check that did not allow admins to edit other users.
the View sends a hidden field called 'id' containing the logged in user, which is the convention used in several other locations.
line 497 had already been updated to check admin access, allowing other users, but the csrf check did not.