fixed so only current user can login to /:user space