implementing ServerSide Authorization