restricted user access to their own lists and beautified urls