prevent users from accessing pages they're not supposed to