diff --git a/server/achievements/earned_achievement_handler.coffee b/server/achievements/earned_achievement_handler.coffee
index b35e6de22..3b54add2c 100644
--- a/server/achievements/earned_achievement_handler.coffee
+++ b/server/achievements/earned_achievement_handler.coffee
@@ -17,6 +17,8 @@ class EarnedAchievementHandler extends Handler
 
   get: (req, res) ->
     return @getByAchievementIDs(req, res) if req.query.view is 'get-by-achievement-ids'
+    unless req.user
+      return @sendDatabaseError(res, "You need to have a user to view earned achievements")
     query = { user: req.user._id+''}
 
     projection = {}
diff --git a/server/levels/sessions/level_session_handler.coffee b/server/levels/sessions/level_session_handler.coffee
index 77d3ce7e0..f0e4b0fc0 100644
--- a/server/levels/sessions/level_session_handler.coffee
+++ b/server/levels/sessions/level_session_handler.coffee
@@ -31,7 +31,7 @@ class LevelSessionHandler extends Handler
 
   hasAccessToDocument: (req, document, method=null) ->
     return true if req.method is 'GET' and document.get('submitted')
-    return true if ('employer' in (req.user.get('permissions') ? [])) and (method ? req.method).toLowerCase() is 'get'
+    return true if ('employer' in (req.user?.get('permissions') ? [])) and (method ? req.method).toLowerCase() is 'get'
     super(arguments...)
 
   getCodeLanguageCounts: (req, res) ->