removed auth check from process_subscription method