allowed getUser after login