title: MVC Authorise logged in user updating own profile
body: <p>This is maybe a little bit of an open ended question.</p>
  
  <p>Basically, I have an MVC project, people can log in and create a profile.  If they are logged in and on their profile page they display Edit buttons to enable them to be able to edit sections of their profile. </p>
  
  <p>This is done via an attribute in the View Model that checks if the profile username matches the logged in username.</p>
  
  <p>What I'm having a little trouble with is when posting back to update details via ajax, how can I ensure the user is updating his profile and no one else's.  I obviously want to make sure no one can hack the site and update someone else's profile.</p>
  
  <p>Do I just have a check in the action that checks if the logged in user matches the profile they are on... if it doesn't then return a 401?  Is there a sexier way of doing this?  Custom Attribute etc...?</p>