web gui deny for user rest