authorize secret page using current user