return error if user is not authenticated