raise exception if unauthorized. clean specs.