Added authorisation to model.php