users can edit their profiles, except pw and avatar (do not bother for now)