only let the logged in user choose challenges
issues #2, #3 covered