added control based on user credentials