added authorization controls