modified has_access_to method on user