added security for user-only operations