Don't allow user access if they are just logged in, check access level too