add rudimentary authorization