fix more work on user access control; begin moving user access control to server-side api