check user before accessing it