with proper user authentication now