only allow user to access the tag that matches username