use EntityFieldQuery instead of db_query and check for user access to entities