check user authentication on /ao/config requests