#6. user and admin can look through card list