use scriptSig to check the sender of the transaction