use filter to do user authorization