authentication and authorization by db