prohibit unauthorized requests