add authentication check