private lists work and block users if they are not logged in, but lists seem to not be properly attributed to a user in the list display.