more controls based on user authentication