deviation from hartl, add authorisation but not index on users