check access on current user with NULL