Don't forget to force the user to authenticate himself