added xidnotauthorized and check for xid in the views