Fix: User can view content using logged out token