restrict access to other user's model and rescue method