authentication and authorization hook
doc