restricted user access when using json