more centralized access control
forgot to add 404 page