making sure users can only create certain types of resources