User must be logged in.