check for authorization