incorrect check for authenticated user