bug fixed: guest can query & borrow items