only serving files to authorized users