set user permission to prevent unauthorize access to other user's listings