restrict user page access