add authorization to user api