adds authorization for users and groups