check for authorized user