some sanitizing helpers
only operate with the right access
more access control
handling flash messages
add access control
access control and styling