restrict non-auth access