add client side authorization