added some backend logic for auth acccess, which apparently customer user uses