fixed permissions for user profiles