refactor query, so that it will check access