added user authentication so that everything is actually secure, even when people mess with the urls