server: tighten restrictions