restrict user access data via urls (other users data ) Logic change (Fix IV)