enforces authorization for experimental api