added client-side authorization