Restrict access to profile editing?

[eluser]Braden Schaeffer[/eluser]
As a learning experience project, I am working on a basic store that allows a user to purchase a theme file and have access to it online.

Here's the gist... let's say I have 10 users and and 2 themes (Theme A and Theme B). 5 users bought access to Theme A and 5 bought access to Theme B. You would edit the files and http://site.com/users/username/edit/theme/theme_id. Though it's not exactly profile editing, you can see how it's similar.

To be honest, outside of logging people in, I have no idea how to prevent anyone from going directly to the URL above and having access to a the users theme file.

I think I have a themes_purchased table in mind where I store a purchaser_id corresponding to a user_id in a users table, so at least I will be able to tell whether the specific user has access to a theme or not, but restricting access to themes purchased by a specific user from other users is a different story completely (at least to me).

Am I on the right track. Does the URL organization above make it at least possible to do what I am thinking of doing?

Any suggestions would be greatly appreciated!!!

Thanks in advance, Braden