removed isAuthenticated attribute when authorizing requests