users get own feeds, still no auth enforcement