move access denied to a method
create a check_authorized method