fixed unauthorized access