restrict user from directly hitting url of content they don't own