restrict user from editing other's stuff