restricting access to the password protected form