Change hard-coded user to $user, added a login check