added authorization rules, the role of supervisor, changed customer