we dont even need user-id set because we're auto detecting ip if public and allowed and user id if logged in