adding ACL check for users resources