restrict resource to user