implements simple authorization