Authorisation check in server end