authorizing correct user