updated user controller to limit profile to current user