protected user- finished