polish up authorization for admin users and whitelisted users