fixed authentication only allow post owner to edit