added verification that user really has logged in