user can see only his page (unless admin)