implementing clientside authorization