reply: restrict submission form to users