added authentication for some create and delete actions