How to enable authenticated user editing their own record in Drupal
Rob - that tends to work by default on the sites we set up using the 'out of the box' drupal permissions for civi relating to Profiles etc. Is it possible that you have removed some permissions that would have let users submit profiles (don't have them in front of me right now)