user needs to be logged in to use api