Add authorization checks for user actions