server-side authorization validation