explicitly deny authorization to new users