protect /users/ and /ucss/