restrict enity search to what user may see