adding authorize attribute (finished)