add authorization check on update action backend