added authorization to ensure users are logged in