users can only add reviews if signed in