added some more checks on user and staff