restrict access to server data to authenticated users