add access control for POST only