unauthorized user can submit a search query