added authorization for users