add more auth checks