use hasAuthority() instead to make expression a bit simpler