requires user to login, api call to get username