but if i lookup the resources a user has access to, i get back all public and all private resources he has access to