authenticated when no window.user