hiding collections from guest

use security:get-user-credential-from-session()[1] instead of xmldb:get-current-user() (which returns guest even if logged in)