limit adding to authenticated users