allow only limited set of users to be authenticated