restrict user to view only their profile