check unauthorize access