add check for user auth