ensure user is authorised