can only show user if signed in