add authorization mechanism, with two roles: {admin, user}