only let users see their own characters