everyone can access achieve page
use resource instead of http
change the way to have currentUser