settings added and locked to signed in only (need current user validations)