updated so users are now locked down to their customer (and super admins can go anywhere)