finalised authorization; built tests on the model level; will start writing controller authorization blocker later