add auth control