add new getUser method and use it
check for permissions