authorization checked in back-end which authenticated only
	closes #14