protect against failed queries by testing auth.user first.