don't allow non-authenticated users access to options