user, session, and page restrictions