use restrict_access to block require user logins before actions