better exception check for not authorized access of limited user