add authentication for edit-update