we don't need write access to user profiles