allow users that are only members, not owners