add authorization ensuring users are logged in