Logged in users should never be a part of the API.