change private to protected into User