added more restrictions on user model