How do we ensure that an user can add expenses, and he is able to see only his expenses?