add correct_user before action to protect the edit/update pages