added authorization logic to server side