users must be logged in to CRUD paths and points