better access control via policies for user related pages.