allow users to authenticate as themselves; do a null check for user