restricts the user to updating Activities where the user_id matches  so they can only update their own activity and not anyone else's (see also the tests in ActivityController)