show_all works for logged in users and logged out