access controller modified: user autorization implemented