locking down the ui when credentials match