add resource link server side authorization