server side authorization to protect users API