You haven’t said that the web user has logged in to your site. Have they?
If not, you need to set the access on the design element so that they cannot view it unless they login. This is generally easiest to do by setting the database ACL to “No Access” for Anonymous, with ability to read public documents and maybe write public documents. Then for the few pieces of information you might want to make visible to them, make those public documents or design elements.
If the web user has logged in, you have a browser caching issue. Refresh the page in the browser and see whether that corrects the problem. You may need to put a META tag on the form so that the browser doesn’t cache it. The problem is that whatever it is hasn’t been modified since they viewed it as a not-logged-in user – it’s still the same document or whatever; they’re just in a different situation of viewing it now, and the browser doesn’t realize that’s an important enough difference to fetch a fresh copy.