more login work

parsed out the restrict function