limit search results based on permissions