basic authorization checking email and array of instance ids