added some server side restrictions
news#new, user#show. little refactoring