initial work for security by user id