added security via user sessions