some validation and authorization