securisation on server-side: action on db require user auth