do not check anonymous user, never reached