check for logged in user (albeit probably insecure)