improve backend security
disable input when not authenticated