added auth check to users