make sure user cant deny hisself access to a protected object