authorization agains a database