add isAuthorized check, and simplify logic