restrict access to the app