require auth to lookup user.