just restrict put and post