added .findByIdForUser