add view permission and refactor authorize to take object not parameters