add auth check before downloading