add authorization feature