restrict checkbox selection to two