add additional authorization middleware