this didn't actually _do_ anything in the past, the users would be prevented from accessing the resource, but they shouldn't be able to even create them