prevent user credential sharing