limited what users can do signed in or out, code is quite broken.