add authorization mechanism, with two roles: {admin, user}

why did this commit was shown as: "by unknown"? It's me! vietvu.