implement check_authorization at application level