a user should only be able to see their posts