moved UserCheck outside of authorization