lock down user creation and editing behind permissions