implement authorization for managing locations