require user in database forms clientside, too