view decorator to check authorization