user should only allowed to access his own profile