implements authorization checking logic.