hiding collections from guest; use security:get-user-credential-from-session()[1] instead of xmldb:get-current-user() (which returns guest even if logged in)