fixes #2 - bookings can be directed to another user