authorization check at /newpost