move restrict_access to postings controller