security update

only logged in user can do something