the class name is "Unauthenticated", but the user is authenticated, just the wrong person