add logout restriction