Require a user to be authorized as well as authenticated