fix user access check