add some authorization logic