call ajax scan only if a user is logged in - otherwise we'll get a 500