non-admin user authorization changes