Check authorization when handling 'GET' request

Signed-off-by: Manson Li <manson.li@matchstick.tv>