Dont allow one user to see entities belonging to another user