authorization and user management implementation