restrict access to add.php