fixed profile cancan flaw user show