* review comment
* handle possible NPE if user is not authenticated