Disallow all except requesting user