set users method to be protected since it shouldn't be used without perms anyways