Access control in location-based services