Added server side authorization enforcement