flesh out isAuthorized()