add a whole mess of authorization checks (fixes #243)

I just hope I didn't break anything...