tightening up accessibility, users can only access thing they are associated with (still some loose ends)