limit editing, creation, destruction to users only