Is there some other security check done or just the "logged in" part? IMHO seeing activities should be a privileged operation (perhaps signed in with admin access?)