limit commands by user or globally