added auth check for appid