restrict user edits to own user