added authorize method for users