Add proper authorization in places