Problems with restricting access via a form field