make the auth check include a check for the user attribute