guard against user not being signed in