Authorisation now should be overly cautious but prevent any unauthorised access.
Disallowed functionality will be added one by one as tests are developed at the same time.