authorize access to profile