add protection for auth with users show