only certain users allowed to submit