working on authentication and authorization