add user authentication check