users/me needs to be accessed after auth